Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers

Back Thehackernews

Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers

Thehackernews •[email protected] (The Hacker News) • July 10, 2026

Share: View original

Learn how to secure AI agents with practical controls for access, visibility, secrets, and risk containment.

Learn how to govern risk, secure AI-built software, and keep control as development moves at machine speed.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

XRING Vulnerability in XQUIC Threatens HTTP/3 Servers with Remote Crash Risk A critical unpatched vulnerability, XRING, has been identified in the XQUIC library, affecting HTTP/3 servers. This flaw allows any remote, unauthenticated client to crash servers using XQUIC with as little as 260 bytes of legal QPACK traffic. All releases of XQUIC up to v1.9.4 are impacted, including Alibaba's Tengine, which is used by major platforms like Taobao and Alipay. The vulnerability stems from a memory corruption issue in the QPACK dynamic table implementation, leading to potential denial-of-service attacks. As of July 10, 2026, there is no patch or CVE assigned, and while a public proof-of-concept (PoC) exists, there are no confirmed reports of exploitation in the wild. The CISA Known Exploited Vulnerabilities catalog does not list this issue, indicating no confirmed active exploitation. The vulnerability has existed since January 2022 and poses a significant risk to organizations relying on HTTP/3 infrastructure. 2 sources 65

Extracted Entities

Attack Types (1)

Platforms (2)

Vulnerabilities (1)